4.1 IKEv2 最基本 Client to Server DVTI

4.1 IKEv2 最基本 Client to Server DVTI
------------------------------------------------------
     tunnel0 ---------------------Virtual-Access
       |                                   |
       |     202.100.1.0      61.128.1.0   |                
------Client------------Internet--------Server--------
172.16.1.1  .1      .10     .10        .1    10.1.1.1
 
----------------------------------------------------


hostname Client


interface Loopback 0 
 ip address 172.16.1.1 255.255.255.0 
 
interface FastEthernet 0/0 
 ip address 202.100.1.1 255.255.255.0 
 no shutdown 
 duplex full
 
ip route 0.0.0.0 0.0.0.0 202.100.1.10 


hostname Internet 


interface FastEthernet 0/0  
 ip address 202.100.1.10 255.255.255.0 
 no shutdown 


interface FastEthernet 1/0 
 ip address 61.128.1.10 255.255.255.0 
 no shutdown 


hostname Server 
 
interface loopback 0 
 ip address 10.1.1.1 255.255.255.0 
 
interface FastEthernet 1/0 
 ip address 61.128.1.1 255.255.255.0 
 no shutdown 
 duplex full 


ip route 0.0.0.0 0.0.0.0 61.128.1.10 


----------------------------------------------------


Server:


1.config AAA
 
aaa new-model 


aaa authentication login noacs line none 


line con 0 
 login authentication noacs 


line aux 0 
 login authentication noacs 


aaa authorization network Yeslab-Local-Group-Author-List local


2.config authorization policy 


ip access-list standard Server-Network 
 permit 10.1.1.0 0.0.0.255 


ip local pool Yeslab-Address-Pool 192.168.1.100 192.168.1.200 


crypto ikev2 authorization policy Yeslab-IKEv2-Author-Policy 
 pool Yeslab-Address-Pool 
 route set access-list Server-Network （推送给远端的本地网段）


3.config IKEv2 Keyring 


crypto ikev2  keyring Yeslab-IKEv2-Keyring 
 peer Flex-VPN
  address 202.100.1.1 
  pre-shared-key local Yeslab-Server
  pre-shared-key remote Yeslab-Client 


4.config IKEv2 Profile 


crypto ikev2 profile Yeslab-IKEv2-Profile 
 match identity remote address 202.100.1.1 
 identity local address 61.128.1.1 
 authentication remote pre-share 
 authentication local pre-share 
 ke